New JSON parser for Go: up to 9x faster than `encoding/json` - <AUTHOR> https://github.com/buger/jsonparser <comment><USER2> This could be useful if only a small subset of the JSON content is needed. It would be interesting to see how it compares when the number of fields grow.

One missing for comparison: [https://github.com/ugorji/go/](https://github.com/ugorji/go/)

<comment><USER3> go-codec is nice, but in my testing I found it to be slower than Go's encoding/json.

<comment><USER2> with the `go generate` version as well ?

<comment><USER3> That I don't know — probably not. Never used it, since my performance issues have always been with raw map[string]interface{} data.

</comment></comment></comment></comment><comment><AUTHOR> I'm the author.

Happy to answer any questions, hope you like it!

<comment><USER3> This is very useful, thanks! Go's slow JSON parser is annoying.

My only criticism is that returning 4 values from a function is not very ergonomic, especially since most of the return values aren't needed in many cases.

It would have been better and more idiomatic to return a struct. Alternatively, let it take a pointer to a struct — this would let you avoid memory allocation in loops (though in theory Go should be able to optimize a struct return, too; anyone know?).

<comment><AUTHOR> Good point, i will think how to make it work.

</comment></comment></comment><comment><USER4> Did you run any compliance test? I don't mind a fast parser, but I fear a fast parser that breaks on unusual-but-standard input...

<comment><USER5> It's definitely _not_ compliant. I just read the code, there's no support for escapes in strings, except for skipping over escaped double quotes to find the string end. This applies to any string, so it also won't correctly match keys that contain escapes. (hence the small number of allocations)

Edited to add: this has its uses, if you know that's all you need. Long ago I wrote a similar xml parser for a project because we had control over the xml being produced, and the garbage overhead from element names was killing us with Xerces; I didn't bother implementing things like DTD support, because YAGNI.

</comment></comment><comment><USER6> Why should anyone want to use it? It only reads and even with that it doesn't do everything you expect from a go json lib. It is basically nothing more than a tokenizer.

<comment><AUTHOR> There is lot of tasks when you need only to read data, 3-rd party API, log processing and lot more. For sure this lib not for everyone, but if you care about performance, and especially memory consumption, this could make sense.

Can you a bit clarify about your expectations?</comment></comment>


What Not to Do When You're Trying to Motivate Your Team - <AUTHOR> https://hbr.org/2018/07/what-not-to-do-when-youre-trying-to-motivate-your-team <comment><USER2> I think the most motivational thing a boss can do for me is to reliably provide criticism that shows they think I can improve, and that I _can_ use to improve.

The most demotivational thing a boss can do for me is to provide criticism that indicates contradictory demands, or that they don't know what they want, or that they are unwilling to accept my limitations.

Compliments are not bad, but kind of superfluous - if I've succeeded at something, genuine recognition means being given something more challenging. And if I've failed at something, nice words are just twisting the knife if they are an attempt to obscure the fact someone has given up on me.

<comment><USER2> Later it occurred to me to rephrase the above as:

\- achieving trust is the ultimate motivation

\- losing trust is the end of a relationship and motivation

Criticism can be a powerful way of demonstrating trust, but it can also signify a loss of trust - it's very contextual. Being ignored, too, can indicate complete trust, or it can indicate disengagement or absence of trust.

</comment></comment><comment><USER3> So I shouldn't thank or say nice things to my team, because they might see it as disingenuous? Seems better than the alternative, no?

The article got close to touching on a successful method of motivating, which is making sure individuals' contributions are communicated throughout the organization in a clear and ideally public manner.

</comment><comment><USER4> These are great suggestions. It reminds me of the inversion technique that James Clear wrote so well about: [https://jamesclear.com/inversion](https://jamesclear.com/inversion)

My question is, what should I do when I'm on the not-receiving-recognition end? I've tried to think of ways of maybe giving myself positive feedback, etc. but haven't really fleshed it out yet. I'm basically in a situation where I don't want to give up the fight to succeed in my role, but it feels like all that is ever visible are my and my team's failures...

<comment><USER2> "It reminds me of the inversion technique that James Clear wrote so well about: [https://jamesclear.com/inversion"](https://jamesclear.com/inversion")

This seems to be vaguer than what I thought of before clicking on the link. I generally react to any proposition that seems compelling and obvious and motivational by asking myself "what if the opposite were true and how would one determine that?" If the opposite could be defended equally well, then the original statement doesn't mean much. Sometimes it seems to me like it's most of what people talk about. Instead of debating, perhaps it's best to just put it aside as non-productive. Apparently that's a subset?

<comment><USER4> I think inversion as a problem solving technique is valuable. It's not necessarily the only tool. For example, to bring it back to OP's article, I know I want to be a good manager but that leaves me with a very huge space of possibility and ambiguity. I can reign that in by inverting the problem, "What would I have to do to be a bad manager?" This bubbles up things like low transparency, lack of follow-through, chastising directs, etc. Now I have a clear list of things I definitely should not do and maybe work on if I realize I exhibit some of those negative behaviors.</comment></comment></comment>


Image manipulation library for PHP 5.3 - <AUTHOR> http://imagine.readthedocs.org

<comment><USER2> This has appeared at just the right time, now I'm re-working my project's image manipulation classes. The PHP GD library functions are a nightmare for readability.

I'll be having a little play about with what I intend to implement and if it works out well I'll likely implement it in my project proper!

> "Why didn't he keep width and height as simple integer parameters in every > method that needed those?" or "Why is x and y coordinates are an object > called Point?"

Seems to me that PHP needs to turn its own primitives into objects so they can be type hinted. Trying to figure out which of a dozen number validation functions to use is an utter clusterfuck at the best of times.

</comment><comment><USER3> It's really good to see some well engineered PHP software coming out.

For my projects I've moved out to Python after having dealt with legacy trash like Wordpress, Google's api libraries, over-engineered frameworks like ZF and lets just say the less said about Propel the better.

Code like this, Symfony 2, Doctrine 2, Lithium etc... are a breath of fresh air. Their obviously written by a group of talented devs and after cutting ties with legacy PHP versions < 5.3 the future of "modern" PHP is looking bright!

</comment><comment><USER4> Looks great, but...I clicked on "examples" and expected examples of output in addition to code examples...Please add these if you have time.

<comment><AUTHOR> thanks, will do!

</comment></comment><comment><USER5> Whats\With\All\The\Backslashes? Am I only one seeing that in the examples?

<comment><USER6> Namespaces, as others have mentioned. The first question I had when I first encountered that as the Namespace operator was: "Why not the double colon operator?"

Double colon is already being used for static member referencing, and in a few talks I've heard from Rasmus, they weren't able to find a way to overload it for Namespaces.

Another option that was discussed was a triple colon operator, which most were opposed to b/c of it's length. I personally think the backslash is ugly, and I kind of like the triple colon operator better b/c of it's similarity to the double colon operator. Regardless of which one is prettier, I wish the double colon operator could have been overloaded.

<comment><USER7> > _the backslash is ugly_

Not only that, it's very unconfortable to type in some international keyboard layouts.

<comment><USER8> If you're talking about the German layout and AltGr, then so are the []{} keys, which are already used quite a lot in PHP programming.

It's the main reason why, even though my phyiscal keys are in German layout, I still have the USA layout in software. It's just nice to be able to make [] with a single key press :)

</comment></comment></comment></comment><comment><USER9> There goes my unique flask-extension documentation style. :(

<comment><AUTHOR> sorry, it looked so awesome and I noticed the kind requirement to use it for flask-only projects after rolled the new sphinx design out. I promise to use a different theme and is something I'm working on now.

</comment></comment><comment><USER10> Just curious, is there a reason you chose GD over imlib2?

I've used both and I think I prefer imlib2 for flexibility and breadth, and there's already at least one imlib2 binding for PHP: <http://pp.siedziba.pl/>

<comment><USER11> Hasn't been updated in a while? Is it even still supported?

<comment><USER10> Thanks, I'd seen so many language bindings for imlib2 (and, yes, gd) that I'd assumed it was an active project, but you're right that it's not. Also gd does a lot more than it used to.

Thanks for the correction!

</comment></comment></comment><comment><USER12> Besides being a great library, its an excellent example of well written PHP code.

</comment><comment><USER13> Looks very nice, a worthy successor to <http://wideimage.sourceforge.net/>

I look forward to using it.

</comment><comment><USER14> i am so glad to be reminded of this. Now i just need to implement a filter for assetic at some point.

Assetic still relies on opti{png,jpeg} which i'm sure works pretty well, but also requires one to call out to an external program.</comment>


8 Outdated notions of entrepreneurship - <AUTHOR> http://blog.penelopetrunk.com/2007/01/05/8-outdated-notions-of-entrepreneurship/

<comment><USER2> How much of this rings true for people here?

Most businesses succeed?

It's only now that the self-employed are happy because they have control over their work and they have a flexible lifestyle?

I see lists like this, generalized assertions with little or no backing evidence, and tend to think it's near fully bogus.

<comment><AUTHOR> I submitted it because I thought it was mostly true. Much of the backing evidence/arguments are linked too in the article. But mostly I think it's of worth for some perspective.

You're right that there are a lot of lists of generalized assertions around -- some of these bloggers sound a bit like the next generation of self-help authors. But sometimes the perspective unique, and valuable, and I think this is one of those cases.

<comment><AUTHOR> I wonder if 'too' here is an ordinary typo, as I'd want to claim it, or it's genuinely true that my fingers don't understand the distinction late at night.</comment></comment></comment>


Web Development on Windows 7: Essential Applications - <AUTHOR> http://devgrow.com/web-development-on-windows-7-essential-applications/

<comment><USER2> In case you are interested in developing on the Microsoft platform instead of Apache and MySQL, Web Platform installer is the way to go. Makes it a lot easier to install Visual Studio Express, ASP.Net MVC which otherwise is a real pain sometimes.

<comment><USER3> Not sure about that. The Web Platform installer has introduced a lot of pain to what used to be fairly simple proceedings. It probably my least favorite application to use.

I set up an Windows 2008 R2 instance on EC2 the other day that did not have IIS7 installed. Even launching the WPI on that instance was painful. IE8 is the default browser, and the default settings in IE wouldn't let you launch the application, and for the life of me I couldn't figure out where the security restrictions were.

So then I went and download Chrome which didn't have the security restrictions, and then I was able to download the WPI and run it.

From within the WPI, I selected IIS7 and .NET 4.0. Ninety minutes later + a reboot or two later IIS7 was installed.

</comment></comment><comment><USER4> I suggest to also check out WebMatrix

<http://www.microsoft.com/web/webmatrix/>

[http://weblogs.asp.net/scottgu/archive/2010/07/06/introducin...](http://weblogs.asp.net/scottgu/archive/2010/07/06/introducing- webmatrix.aspx)

</comment><comment><USER5> Not specific for windows but I do like Adobe's Browser labs. <https://browserlab.adobe.com/en-us/index.html#>

</comment><comment><USER6> The only thing I do different is using FileZilla for my FTP client. Oh and Dropbox for working on HTML/CSS front-end stuff so team members can see changes in almost real time.

</comment><comment><USER7> Tunnelier (<http://www.bitvise.com/tunnelier>) is a great tool to use with Notepad++ for SSH tunneling

</comment><comment><USER8> any suggestion for a firebug equivalent and a way to install all versions of IE simultaneously ? I am really struggling with that big time.

<comment><USER9> I presume you mean an equivalent to Firebug for IE.

There's Fiddler and Visual Studio, or you can try Firebug Lite.

As far as multiple versions, the only solution I've found is multiple VMs which sucks, but that's what happens when the browser is tightly integrated with the OS.

<comment><USER10> IE9 also has it's own debug tools built-in which are similar to Firebug. Press F12.

<comment><USER11> IE6-8 also have a developer toolbar but it is no where near as powerful as Firebug. [http://en.wikipedia.org/wiki/Internet_Explorer_Developer_Too...](http://en.wikipedia.org/wiki/Internet_Explorer_Developer_Toolbar)

<comment><AUTHOR> This is what I've been using but I've found it to be incredibly glitchy, at least on IE8. At times it will recognize an element, sometimes it won't. Sometimes the document fails to load completely in the editor, even though the page has loaded fine in IE.</comment></comment></comment></comment></comment>


Ask HN: How do large companies send newsletters to massive email lists? - <AUTHOR> Managing a list of subscribers below 2k is fine though pretty expensive once you exceed 2k. What if a company is looking at using their client list that has around 200k and using a service like mailchimp, sendinblue, etc absolutely wouldn't work given the limitations and price.
Ideally I wouldn't want to jeopardize any IPs or domains. I also don't want to spend ridiculous amounts of money on this either.
So maybe break it up into parts. How are folks handling email lists of 2k, 5k, 10k, 200k and whatever process massive corp X does to handle email lists of M+. <comment><USER2> I have used the Salesforce service formerly known as ExactTarget to send emails to 6-figure lists. Other ET clients have included Microsoft, Apple, the Republican National Committee, etc. I've also used Marketo and Emma to send emails to 5-figure lists.

Mailchimp's pricing tool tells me that 200k subscribers will cost $875/month for up to 2.4 million emails sent. I will tell you that that is a fraction of the cost my employers have paid for the above platforms.

The thing to understand is that it is expensive to _reliably_ send high volumes of email. Anyone can send high volumes of email if they don't care how many go into the spam folder. Sending spam is cheap. Sending email so that every single one gets to the inbox is expensive.

Why? Because to send high volumes of email reliably, you have to follow elaborate steps to prove that you're not sending spam. That means building lists through opt-in only, using clean IP addresses, warming up the IP addresses over time with progressively larger successful sends, aligning domain names across header fields and content links, applying every type of email authentication, hooking into common recipient feedback paths, monitoring and dealing with blacklist services, etc.

If you just want to slam a ton of emails out the door, and have some technical capability, you can save money using a "dumb" mail sending platform like Mailgun, Sendgrid, Amazon SES, etc. But you won't necessarily get "marketing" type features like link tracking, engagement reporting, responsive templates, etc. It does look like Sendgrid can give you a lot of that stuff for 200k contacts, for about half the cost of Mailchimp.

<comment><AUTHOR> Appreciate the detailed response, I was curious if they did it in house and seems like they don't and Salesforce is pretty prevalent.

Looking into sendgrid. It's not super important that they all make it there and if it takes a few hours that's not an issue either. Trying to do a monthly newsletter but to a large list that I have broken up between groups. My biggest fear even after doing a mailchimp campaign was being flagged for spam and that then the domain would have problems sending actual emails to business contacts, partners, clients, etc and working with blacklists. Even worse if the IP is flagged for issues.

Sendgrid pricing looks fair but mailchimp was super slick as far as platform goes. Maybe the route is to buy a new domain that's similar like a previous commenter suggested and sign up with this to blast the 200k. I actually have a domain name that is very similar I'm not not using and that domain redirects to the main site + all those emails get forwarded to the real emails (some people make the mistake of sending to it). It simply has another word at the end.

</comment></comment><comment><USER3> Getting email delivered to inboxes costs money and requires care. If mailchimp seems out of the ballpark from a cost point of view, that's a signal that you shouldn't be sending massive email campaigns.

</comment><comment><USER4> Sending email to many people means there can be errors in sending, and it will be read on many different client and devices.

Mailchimp offers you a reliable way to send, and templates that are pretty well tested. In addition to many more features including sending email at the "right time" for the user.

If your problem is only money, and you can trade it for time to deliver, then there are SaaS like Mailup with a different business model, that charge you for speed. You can send to 200k users for free but it will take a lot of time.

Next, if you want to save more money and you can build your own template, you can set up a tool like Sendy which is basically a self-hosted (very) simplified mailchimp. That can be used with Amazon SES, or Sendgrid. If you're scared about your domain, just buy one that looks similar enough and open an AWS account in another region.

Finally, you can build your own, including integrating in your analytics tools, etc. Again, I'd use SES or Sendgrid or similar, instead of managing my own SMTP server, which is an operational nightmare.

(I have no experience with Salesforce Marketing Cloud, that others are referring.)

</comment><comment><USER5> Disclaimer, I work with SendGrid. That is what the whole ESP space is about. Check out some of the players, and pick one you like. You should spend dramatically less on a service such as SendGrid than you would spend on personnel to handle all the ins and outs of email deliverability.

<comment><AUTHOR> I'm liking the pricing with you guys, I have a list of contacts currently around 5k that will probably take awhile to grow to 10k that I wouldn't mind paying $10/m to send monthly emails to. Now again I want to send a warm "open" to them to update their subscription settings and whatnot but since many may be a little old (we rarely sent emails except direct correspondence) I'm super concerned about people hitting "mark as spam" and it becoming an abuse complaint resulting in domain blacklists. I did a 2k run on an actual newsletter with mailchimp and 4 people did that. About 19 unsub'd which is fine. Any advice?

<comment><USER5> We have a lot of posts that talk about avoiding being flagged as spam, such as:

[https://sendgrid.com/blog/10-tips-to-keep-email-out-of- the-s...](https://sendgrid.com/blog/10-tips-to-keep-email-out-of-the-spam- folder/)

These kinds of articles will be able to provide better advice than I can in a comment thread. One tip, if it is in the budget, is to have two sending IPs. One for transactional mail and one for newsletters. This will let you keep your transactional mail's IP's reputation higher.

</comment></comment></comment><comment><USER6> I am having a site which provides information regarding properties in Hyderabad [https://propertyadviser.in/](https://propertyadviser.in/), For promotion of site I am looking for sending bulk e mails suggest me a site for this.

</comment><comment><USER7> We use Salesforce Marketing Cloud (formerly ExactTarget) for multiple lists totalling around 2M subscribers.</comment>


Twitter user hacks 50k printers to tell people to subscribe to PewDiePie - <AUTHOR> https://www.zdnet.com/google-amp/article/twitter-user-hacks-50000-printers-to-tell-people-to-subscribe-to-pewdiepie/ <comment><USER2> The April Fool's joke that nearly got me fired was a combination of easily accessible JetAdmin ports, an HP control sequence, a script to find every JetAdmin on the internal network and a distinct lack of common sense. But it was so worth it. So worth it.

<comment><USER3> Many years a go in college, on some course one guy created a postscript file that when printed reprogrammed HP printer(s?) of the time to add one (1) zero to every number on documents that were subsequently printed.

<comment><USER4> All fun and games until you accidentally commit fraud.

<comment><USER5> > accidentally commit fraud.

That isn't a thing. Fraud is deliberate deception. You can not commit accidental deliberate deception.

<comment><USER6> True, but you can still be found guilty of fraud even so.

</comment></comment></comment></comment></comment><comment><USER7> The only thing surprising about this is that these printers hadn't already printed enough random garbage to get disconnected/firewalled off from the internet.

The number of printers from a simple search [1] that have no authentication is staggering.

[1] [https://www.shodan.io/search?query=printer](https://www.shodan.io/search?query=printer)

<comment><USER8> That was astounding already 20 years ago. Fax spam was out of control then to such a degree that Congress roused itself to pass legislation with teeth, yet it occurred to no one to send printer spam. The only thing that would connect to our printers was viruses, the probable target was port 631 with buggy CUPS or other LPD daemon behind, because every few hours the printer would run off a page with just a few gibberish letters.

</comment></comment><comment><USER9> I thought Twitter might somehow be pertinent to the hack but, apparently, this person just happens to have a Twitter account.

</comment><comment><USER10> "Hacked" = people left their printers open to the internet.

<comment><USER11> Identical actions of another can result in my car being stolen whether I leave it locked or unlocked.

<comment><USER12> Sure, but that doesn't mean that it was "hacked", either.

This is lots closer to calling unlisted telephones.

<comment><USER13> Printing one sheet costs around $0.15. The 50,000 he printed likely cost his targets a total of $7500. That's second degree felony grand theft territory. Good luck.

<comment><USER14> Can prosecutors aggregate the value of damage across thousands of unrelated victims for the purpose of charging grand theft? My gut says this is probably not the way it works, but I'm curious if others know more.

As a side note, I don't think what he did can be charged as theft, technically speaking, because theft laws generally require the perpetrator to _take_ property from the victim.

This case would be destruction of property or vandalism, if my memory of law school serves. And I don't think there are _grand_ versions of those crimes, at any rate.

<comment><USER13> If I stole a penny from millions of people do you think I'd be charged for stealing a penny?

Yes, this is how it would be charged.

>because theft laws generally require the perpetrator to take property from the victim.

If I sent a penny from millions of people to another person, would I be innocent of crime?

If I burned up money in another person's safe, would I be innocent?

The law will look at the damage to the victim(s), in aggregate. That the person causing the losses only hurts each a little or doesn't end up with goods is irrelevant.

Besides the normal value of goods laws, there are even tougher computer fraud and abuse type laws. Those could really cost him if some prosecutor decided to pursue those. I suspect there are Feds right now looking at this case and how to proceed.

Personally I don't want to see this person get prison for a felony, but perhaps charging him with it will make him or others think twice about such behavior next time. Community service or such would be a good outcome.

</comment></comment></comment></comment></comment></comment><comment><USER15> Never new that guy was so popular... I don't really understand why. But damn that's some dedication by fans to boost his subscriber count...

<comment><USER16> It's really silly to ruin your life with a criminal record like this, but at least the guy did something useful with his fandom. A lot of kids on YouTube are just watching, wasting away.

<comment><USER17> A lot of (adults) on (Netflix) are just watching, wasting away.

<comment><USER18> A lot of (people) on (television) are just watching, wasting away.

So at the end of the day we learned that nothing ever really changed.

<comment><USER19> My mother objected to me spending too much time reading and not enough outside.

I imagine there were people in the stone age that objected to people wasting too much time near the fire and not enough fighting with sabertooth tigers.

<comment><USER20> Exactly that! When I was living on the street, we used to call the fire "stoneage-tv". Because the human brains have such a long history of staring "into" the fire, I have the mild suspicion, that reading on e-ink displays without a backlight might make it less likely to get lost in thoughts, than when staring on a "glowing" screen. Unfortunately the only competetive screens are still rather expensive (paperlike)..

..damn, I got lost in offtopic thoughts again! ; )

<comment><USER21> It's an interesting thought! If you had a Twitter account in your bio, I would have followed it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> I work at a large printer company - similar name to a famous fantasy novel series. I have joked for ages about "Denial of Ink and Paper" attacks. To co- workers: I told you so.

<comment> joatmon-snoo It's even got a Wikipedia entry! [https://en.wikipedia.org/wiki/Black_fax](https://en.wikipedia.org/wiki/Black_fax)

</comment></comment><comment><USER23> A number of years back, I was trying to learn about network programming and SQL and decided to try and build a a kind of randomized port scanner that would generate IP addresses randomly, then scan semi-random ports on those that were pingable, and finally store the results in a database.

I quickly found a couple (not a lot, but I was kind of shocked to find _any_ ) of printers that were totally exposed to the Internet. While I can proudly say I even resisted the temptation to make them print out something clever like "Wer das liest, ist doof", I figured it was only a matter of time before somebody with less self-restraint would come along.

At work, all our printers still respond to the default passwords one can so easily find on the Internet, but at least they are not reachable from the outside. Printers are not considered a security problem, because once someone is on our internal network, they could do much worse things.

But still, exposing them to random people on the Internet is begging for something like this to happen.

</comment><comment><USER24> I am really surprised these kinds of printer "hacks" are still possible _in 2018_.

<comment><USER25> Are you kidding? IoT stuff doesn't have any security either, and it wasn't invented 100 years ago.

<comment><USER26> True although there are previous technologies enabling home appliances to be connected and controlled from outside through radio and telephone couplers. X10 which dates back to the mid 70s is probably the most famous one. Back then there were no such things as encryption protocols: if someone knew your air conditioner was connected to your phone line he could turn it on just by phoning to your home and sending the right tone over the line. Hacking was just a matter of time spent finding the right frequencies; no firewall to prevent anyone from trying a thousand times until someone would hopefully notice and pull the cord. Despite those "vulnerabilities" though, I never heard about abusing other peoples devices. I would be interested in hearing experiences from actual owners (or hackers:) of those old systems.

</comment></comment></comment><comment><USER27> Anybody have any idea if bots (or fake accounts) are involved in increasing the subscription count?

<comment><USER28> I've heard of rumours of T-Series, the challenger, got their subscribers count steadily moving up when YouTube was down globally earlier this month, which indicates botting, but what do we know? It's all foggy under Google's algorithms.

[0] [https://mobile.twitter.com/socialblade/status/10523754246160...](https://mobile.twitter.com/socialblade/status/1052375424616030209?lang=en)

<comment><USER29> Most of T-Series' subscribers come from people creating accounts in India and getting automatically subscribed to T-Series by YouTube's algorithms.

YouTube did this a while back with other demographics. For instance, CaptainSparklez often mentions this as one of the reasons why he became big; i.e. YouTube was autosubscribing folks to certain creators.

EDIT: If I recall correctly, when you create a new YouTube account, they give you a list of channel suggestions that you can check off to bootstrap you into suggestions based on your preferences, so this could be that, meaning people just "select all".

<comment><USER30> One Pewdiepie fan created a USB device that automatically unsubscribes from T-Series when plugged in: [https://www.reddit.com/r/PewdiepieSubmissions/comments/a0ldp...](https://www.reddit.com/r/PewdiepieSubmissions/comments/a0ldpi/i_made_a_script_that_unsubs_to_tseries_when/)

Here's one that auto-subscribes to Pewdiepie: [https://www.reddit.com/r/PewdiepieSubmissions/comments/a0wcd...](https://www.reddit.com/r/PewdiepieSubmissions/comments/a0wcdb/just_saw_that_guy_who_made_a_unsubscribe_from/)

Source code: [https://github.com/Alone2/SubscribeToPewdsScript/blob/master...](https://github.com/Alone2/SubscribeToPewdsScript/blob/master/digiPew.ino)

</comment></comment></comment></comment><comment><USER31> How was this done? I think of Twitter messages as something you can view in the app or browser. How can you send a message to the printer from there? Can someone please explain.

<comment><USER32> Try reading the story and not just the headline.

</comment></comment><comment><USER33> Many organizations are in dire need of departmental NAT firewalls and VPN solutions. I had to beg, bitch and moan before a Pac10 uni would offer such a service to protect our users.

<comment><USER34> Actually all it takes is a firewall. As far as hiding hosts goes, a firewall is just as good as NAT. And then if you _do_ need a host or two accessible, the firewall is easier to change than the NAT.

</comment></comment><comment><USER35> If I was subscribed to that guys YouTube channel (which I'm not, since the guy is an idiot), someone pulling a stunt like this would probably prompt me to unsubscribe.

</comment><comment><USER36> ah distinct IP's that can not be distinguished as proxies. suppose this goes to the iot as apposed to zombie computers.

</comment><comment><USER37> We all know youtubers will go to any length to grab subscribers but the way pewdiepie is doing the campaign has left a very bad taste.

He started to drag India and even released a diss track, made it look like its T-Series/India vs rest of the world. I think its a deliberate ploy to drag India since he can pull more subscribers that way. There are lot of live count stream tracking the subscribers between pewdiepie vs T-Series. On the chat i could see lot of hate from these kids like lets beat up Indian kids on school & lot of ethnic hate. I know these are something you can't avoid in Internet and best to ignore. But i can't help but feel bad for Indian kids living abroad since most of his subscribers are kids/teens and they can be easily influenced by these sort of campaigns.

We can't blame pewdiepie nor expect him to act mature even though he has more than 70 million subscribers. But youtube needs to have some sort of policy on subscriber campaigns to avoid these type of scenarios. If not for all at least for influential youtubers.

<comment><USER38> It's quite obvious after watching his videos that the 'campaign' is just a joke. Felix and his subscribers know that he will inevitably lose the top spot on Youtube and they're just having some fun.

Majority of Felix's content is just satire and inside jokes. If you know Felix and his content, it's very obvious that the diss track is actually poking more fun at other Youtubers who make diss tracks unironically.

Here's a decent video by EmpLemon explaining the history of Pewdiepie's channel and where he is now: [https://www.youtube.com/watch?v=1cvgoY0cmzk](https://www.youtube.com/watch?v=1cvgoY0cmzk)

<comment><USER37> He used to be all that but i don't think its the case off late. But i know his jokes are not for everyone so may be its not for me.

Thanks for the clarification and video.</comment></comment></comment>


The Jobs Crisis at Our Best Law Schools Is Much, Much Worse Than You Think - <AUTHOR> http://www.theatlantic.com/business/archive/2013/04/the-jobs-crisis-at-our-best-law-schools-is-much-much-worse-than-you-think/274795/#

<comment><USER2> This happens with every profession that takes on the perception of guaranteeing a nice salary.

I expect the big difference with law is that the profession is taught/promoted by established universities which have managed to keep the notion afloat in spite of an established lack of demand.

</comment><comment><USER3> This article presupposes that large numbers of lawyers should have an easy time finding work.</comment>


Hack Your H8 Mini Toy Drone: Better, Stronger, Faster - <AUTHOR> https://dronegarageblog.wordpress.com/2016/01/25/hack-your-h8-mini-toy-drone-better-stronger-faster/ <comment><USER2> With a special!?! With a special???!!</comment>


New worm can infect home modem/routers - <AUTHOR> http://apcmag.com/Content.aspx?id=3687

<comment><USER2> Gotta say, that's pretty interesting. I've become very curious recently about "The Botnet" and just exactly what it is, how it is maintained and what resources it relies on/consumes ... which might be ignorance?

Some purists may be against my referring to what is a distributed and loosely organised menagerie of differently compromised systems as a singular entity, but I find it inspiring to think of this as the common enemy that binds the internet civilisation.

I have heard many a deeply fascinating story about the exploits of this web marauder, such as the well known Estonia ddos: <http://tinyurl.com/3ashwk>

as well as theories that dispute the controlling agents of the botnet, arguing for and against the autonomy of "The Botnet" itself. With some stating it's defence mechanisms mirror those of immune systems or other organic systems. (not sure where my reference is for that one)

With this being such a massive force on the internet, what do people know of vigilante justice that seeks to control "The Botnet"? I find it hard to believe that the old-school "white hat hackers" would allow themselves to be pushed aside by this mother of all script kiddies!

I had a quick look around and all I could find was this interesting little morsel: <http://tinyurl.com/de4t5l>

essentially a distributed proxy shield that (if I'm not mistaken) inverts the tor architecture and incorporates a relatively expensive authorisation to perturb the activity of a botnet attack on a particular server.

But what I'm really looking for is a legitimate attempt to set up some distributed system to attack the botnet itself?

just some food for thought, I thought.

</comment><comment><USER3> This article seems a bit confused about how the worm is spread: It is a simple bruit force password attack, targeted at mipsel Linux-based routers.

The post at DroneBL (linked to by the article) seems to be a better read:

<http://www.dronebl.org/blog/8>

</comment><comment><USER4> The network equipment producers use cheapest programmers, which never ever will read Red Book ( [http://www.amazon.com/UNIX-System-Administration- Handbook-3r...](http://www.amazon.com/UNIX-System-Administration- Handbook-3rd/dp/0130206016) ), or File System Hierarchy Standard, or any other standard.

My mobile phone (Motorola A1200 with MontaVista Linux) has "root" user with empty password. It was very non-trivial to change password, because root file system is read only. :-)

IMHO, equipment producers should use persons with experience in both programming and administration (like me ;-) ), or use experienced administrators to review embedded systems before they are shipped to end users.

Government should also try regulate minimal acceptable level of security in network-connected devices, because ignorance of these security related problems creates huge risk for everybody. Imagine robots, which are controlled by hackers. Network devices can steal your credit card number and/or open doors for other trojans. Robots can steal your credit card and/or open door for breakers.

See also: "Researchers Demo BIOS Attack That Survives Disk Wipes" <http://it.slashdot.org/article.pl?sid=09/03/23/1248214></comment>


How to Adjust Tkinter UI? - <AUTHOR> I have coded a simple ui, but have some issues https://old.reddit.com/r/learnpython/comments/cxszgl/tkinter_ui/ <comment><USER2> Omg, Tkinter is so nostalgic for me! I still remember working with it back during the initial intro to CS courses. Sorry to not be mlre helpful!</comment>


GDPR Tracker – Track the GDPR Compliance - <AUTHOR> https://gdprtracker.io/ <comment><USER2> Thanks for sharing. Do you have any feedback?

We created this tracker to overcome the complexity of tracking the GDPR compliance & security practices of our SaaS vendors. We shared our story building the tracker in the following post: [https://medium.com/privacy- radius/announcing-gdpr-tracker-tr...](https://medium.com/privacy- radius/announcing-gdpr-tracker-track-the-compliance-of-your-saas- vendors-19436f083e47).

<comment><AUTHOR> this is great, thanks, i found it to be a very good idea. Actually i am creating an andorid app with gdpr checklists and resources, already included the gdprchecklist.io, wanted to talk to you about it. I will include the tracker as well, hope you don't mind :).</comment></comment>


Traceroute Mapper – Show Your Traceroute on a Map - <AUTHOR> https://stefansundin.github.io/traceroute-mapper/ <comment><USER2> Neat. Just curious, why do I need to turn off ublock for this to work?

<comment><USER3> Hi Dave. Because of overzealous filters, unfortunately. The "EasyPrivacy" seems to block the whole ipinfo.io domain if it's included as a third-party request.

<comment><USER4> I'm using Adblock Plus on Chrome. Even if I configure it to stay disabled on your domain, I still get the "Request not sent to ipinfo.io. Are you using an adblocker?"

Not sure what's going on.

<comment><USER2> You may need to refresh the page after you disable it for this particular site; this was the case for me.

</comment></comment></comment></comment><comment><USER5> Love this!

"ipinfo.io ratelimit exhausted. Please try again tomorrow, or run the script from your own server."

Needs a port to Linux (from .bat).

<comment><USER3> There's a bash function in the README:

function traceroute-mapper { xdg-open "[http://stefansundin.github.io/traceroute- mapper/?trace=$(tra...](http://stefansundin.github.io/traceroute- mapper/?trace=$\(traceroute) -q1 $* | sed ':a;N;$!ba;s/\n/%0A/g')" }

</comment></comment><comment><USER3> Sorry about the rate limit issue everyone. I tweeted the ipinfo guys and it seems like they're willing to give me a limit increase, but they haven't yet. You can give them a nudge here: [https://twitter.com/ipinfoio/status/861701746158170112](https://twitter.com/ipinfoio/status/861701746158170112)

Also, if you want to self-host the website (and thus get your own ipinfo ratelimit quota), it seems like the Google Maps API now requires you to get an API key (it didn't before). Get one here: [https://developers.google.com/maps/documentation/javascript/...](https://developers.google.com/maps/documentation/javascript/get- api-key)

</comment><comment><USER6> Reminds me of [http://pratyeka.org/ctrace/](http://pratyeka.org/ctrace/) which I wrote years ago and which made it to some *BSD ports trees. IIRC it parses a bunch of different traceroute formats as well as implementing its own. The parsing allowed it to interpret the output of different web traceroute gateways which at the time was kind of cool. Probably very little of the code works anymore.

</comment><comment><USER7> The following shows up at Fremont but it should be NYC, right?

        7  100ge10-1.core1.nyc6.he.net (22.214.171.124)  10.344 ms  9.712 ms  20.411 ms

<comment><USER8> Yes this is the disadvantage of traditional IP geolocation databases. They work mostly by sourcing information from RIRs and ISPs. Unfortunately for a lot of larger organizations which typically exist in internet backbone that is very inaccurate. This skews the traceroute mapping significantly.

I don't want to shamelessly plug-in stuff here but we have geolocation API which uses latency triangulation and does not suffer from those issues.

Stefan - I would be more than happy to donate the API access if you have time to integrate it. Can I email you with details ?

<comment><USER4> > _we have geolocation API which uses latency triangulation and does not > suffer from those issues_

Who is "we"? I'd like to test drive a service like that.

<comment><USER8> You can send me email to firstname.lastname@example.com or through contact us page on www.speedchecker.xyz

We operate large scale testing platform which can ping from many locations so we can triangulate better, demo here - [http://www.maplatency.com](http://www.maplatency.com)

<comment><USER8> Here is more information and demo page> [http://www.speedchecker.xyz/server- geolocation.html](http://www.speedchecker.xyz/server-geolocation.html)

</comment></comment></comment></comment></comment><comment><USER9> There's an old iOS App called Vtrace been doing this for years. Interesting to see toures from my home to a destination 10 miles away bouncing all overr the country several times. Not promising for when I need a short round trip time for musical collaborations.

</comment><comment><USER10> Looks a little buggy when the red line won't cross an ocean. Am I missing something?

</comment><comment><USER11> Is it possible to make this a local app so you don't have to use the web?

<comment><USER12> just hook up _traceroute_ plus _ipinfo.io_ with _MapSCII_ [https://news.ycombinator.com/item?id=14254165](https://news.ycombinator.com/item?id=14254165)

</comment></comment><comment><USER13> This is super cool. I've tutored an introduction to internet design course, and we spend quite a while talking about the infrastructure of the internet - I'll totally chuck this in.

</comment><comment><USER14> Mandatory comment: Be sure to Traceroute bad.horse

<comment><USER15> How does that work?

<comment> robinson-wall Someone has set up the routing to 126.96.36.199 so that it passes through many other address which they control (188.8.131.52 through to .157) the reverse DNS for, and customised them in the appropriate order:

        $ dig -x 22.214.171.124 +short
        a.murder.would.be.nice.of.course.

<comment><USER16> Possible that its done entirely in software too, you could write something in golang or perhaps even just iptables that would do this in a few hours.

</comment></comment></comment></comment><comment><USER17> I remember a Windows tool that used to do this, like 15 years ago. I remember using it and getting quite fascinated.

<comment><USER18> I remember using neotrace myself.

<comment><USER19> I remember _supporting_ NeoTrace, via landline no less. And stuffing envelopes with floppies for the purchased version (it was shareware). And writing some of the code too.</comment></comment></comment>


Emergency Directive 20-03 – Remote code execution vulnerability in Windows DNS - <AUTHOR> https://cyber.dhs.gov/ed/20-03/ <comment><USER2> This isn't snark - I am serious.

Who would be running a DNS server on a Windows system ?

Why would they be doing such a thing ? What is the thinking here ? I understand running windows-specific infrastructure like an AD server or a PDC or whatever but ... a DNS server ?

<comment><USER3> You do understand that the corporate world runs on Microsoft Windows and Active Directory, right?

DNS is an absolutely critical component of Active Directory (there's even an old joke that, when dealing with Active Directory issues, "it's always DNS").

In an AD environment, clients are almost always configured to use Windows DNS servers as their DNS servers, with the Windows DNS servers then performing forwarding (of any unanswerable queries) on their behalf. This way is, by far, a helluva lot easier.

You _could_ have non-Microsoft DNS servers that slave the zones from the Windows DNS servers and point the clients at those.

You can even go a step further and avoid using Microsoft DNS entirely. Despite what some people (even some here, apparently), you absolutely _CAN_ run Active Directory _without_ using Microsoft DNS _at all_ (although there _are_ several advantages to using Microsoft DNS)! BIND, for instance, can be used instead of Microsoft DNS. It completely supports all the features that are needed for Active Directory -- in fact, it provides a number of additional features that are often "nice to have" as well.

Because it is a PITA to set up and support, though, these type of deployments are fairly uncommon. In most cases, it's much "easier" to just use Microsoft DNS (which can be installed and set up for you automatically when first deploying Active Directory) -- especially when the folks managing Active Directory don't really have a great understanding of DNS itself. For example, I imagine the average Windows administrator would be completely dumbfounded if you asked them to hand-edit a BIND zone file! Instead, with Microsoft DNS, they can just point and click their way around.

This, of course, leaves out all discussion of DHCP which (in a corporate Windows environment) is pretty much always required as well. Running all of this on Windows means you don't have to deal with integrating all of the various pieces yourself.

<comment><USER4> A "win" w/ Active Directory-based DNS servers (and storing the DNS records within Active Directory) is that you get replication between the DNS servers by way of AD replication "for free". There's a certain component of "snake eating its own tail" to it, insofar as you have to bootstrap new Domain Controller computers by having them use another DNS server while they pull their initial replica. Active Directory-integrated DNS gets you per-record ACLs to authenticate dynamic updates, too.

<comment><USER3> Yeah, there are certainly numerous benefits of AD-integrated DNS, such as built-in zone replication via AD replication, secure dynamic updates, updates can be made on any DNS server (e.g., "multi-master"), DHCP integration, and probably several others I'm forgetting at the moment.

At least some of these are available in other DNS servers as well but I'd certainly agree that AD-integrated DNS is much easier to deploy, manage and maintain.

<comment><USER5> > updates can be made on any DNS server (e.g., "multi-master")

This cannot be overstated. I'm currently in the process of trying to rehabilitate an existing DNS infrastructure based on BIND, and it is a complete disaster. All the "high availability" stuff is focused around replicating zone databases from a single master to many slaves, which will indeed continue answering queries even if the master is down. It appears there is basically zero concern for ensuring that updates will continue to be accepted and distributed to slaves if the master fails. The documentation doesn't address it, and none of the many conversations I found through Google had good answers. I have no idea how large DNS installations are built on this software.

<comment><USER6> Bind can have multiple master servers. I don't understand why it wouldn't continue answering queries when the master is down either, you only need the master to answer IXFR/AXFR. Maybe your SOA has some really short times in it? I'm not great with bind but I've been doing a lot with it lately (using it to feed large DNS servers) so you're welcome to email me if you want help.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Cybersecurity and Infrastructure Security Agency

Report (PDF) :

[https://cyber.dhs.gov/assets/report/ed-20-03.pdf](https://cyber.dhs.gov/assets/report/ed-20-03.pdf)

</comment><comment><USER7> Even if your Windows DNS is not exposed to the internet, it means that anyone getting a device on your WAN can get windows domain admin.</comment>


Rust DataBase Connectivity (RDBC) - <AUTHOR> https://andygrove.io/2020/01/rust-database-connectivity-rdbc/ <comment><USER2> 1\. Can `Box<dyn RowAccessor>` even work like that, considering it's not object safe? My understanding is that adding the `Self:Sized` bound to `get` makes it compile, but also means that this method won't be available in a dynamic context, so the accessor you get from the rowset is completely useless.

2\. Why do the accessors return results? IO errors should already happen when loading into the rowset. So at that point the only error the column accessor could run into is an out of bounds index, which is a panic worthy programming error.

3\. Why do the accessors return options? Shouldn't that be absorbed into the generic `T` and only be used for nullable columns?

4\. Why return owned accessors (boxes) instead of references?

5\. Columnar datastorage without any low level access to the in-memory representation seems rather pointless, for a performance point of view. You can't access it with SIMD instructions and incur an indirect call overhead for each accessed element. Do you expect people to downcast the column accessor to a specific type for high performance access?

IMO abstracting over storage formats via dynamic dispatch is the wrong approach. The proper way is making all types take a generic a parameter for the format.

<comment><USER3> What you write sounds extremely sensible to me! Thoughts:

2\. Loading the rows might be lazy, using a cursor etc, so you could encounter IO errors while traversing the rowset. You really, really want lazy rowsets for iterating enormous results without having to materialise the whole lot in memory.

5\. Maybe as well as element-by-element access, there should be some sort of bulk access to get a buffer full of elements in one go.

A. I'd like to see some way to use a ColumnAccessor, or some other thing, to access elements in a row. I would like to write code like:

        use std::io::Result as IoResult;

        struct Column<T> {
            column_type: std::marker::PhantomData<T>,
        }

        struct Row {}

        impl Row {
            fn get<T>(&self, column: &Column<T>) -> T { unimplemented!(); }
        }

        struct RowSet {}

        impl RowSet {
            fn get_column<T>(&self, name: &str) -> IoResult<&Column<T>> { unimplemented!(); }

            fn get_row(&self, index: u64) -> IoResult<&Row> { unimplemented!(); }
        }

        pub fn main() -> IoResult<()> {
            let rows = RowSet {};
            let weight_column = rows.get_column::<f32>("weight")?;
            let row = rows.get_row(23)?;
            let weight = row.get(weight_column);
            Ok(())
        }

The point being that i can do the lookup of the column once, ensuring that it exists and has the type i expect, and then safely extract column values from rows later on.

<comment><USER2> 2\. I understood the `RowSet` as representing a batch, not the whole data set.

A. I agree that the column should only be requested once, similar to what you propose. Though I'd move the lifetime into the `Row` type instead of returning a reference. Unfortunately you don't totally escape the runtime check, since you still need to check if the column and row come from the same RowSet.

<comment><USER3> > I'd move the lifetime into the `Row` type instead of returning a reference

I'm afraid i don't understand; which lifetime, and which returned reference?

> Unfortunately you don't totally escape the runtime check, since you still > need to check if the column and row come from the same RowSet.

True, but at that point it's a programmer error, so at least you can panic rather than returning a Result!

</comment></comment></comment></comment><comment><USER4> I appreciate that the author here takes pains to review existing standards and implementations like ODBC/JDBC, and also reviews newer ideas like columnar stores and projects like Apache Arrow. It inspires confidence when I see engineers do some degree of review before swashbuckling their way into new code. It's like the literature review in graduate school: first read, then code.

<comment><USER5> Andy Grove is a PMC on Apache Arrow, and a great columnar store community member. It was probably less of a literature review for him than a reflection on past experience.

<comment><USER4> I didn't have that context—thank you. Still, I guess it's an endorsement when systematic review of prior art can be mutually confused with experience :-)

</comment></comment></comment><comment><USER6> There are also other projects working solving similar problems.

The other is sqlx[0] serving as an asynchronous crate connecting to mysql and postgresql that validates the queries at compile time and is built as a new ground-up implementation using async/await and async-std.

And our project is quaint[1] which builds on top of existing tokio-based database crates giving a unified interface and a query builder.

[0] [https://crates.io/crates/sqlx](https://crates.io/crates/sqlx) [1] [https://crates.io/crates/quaint/](https://crates.io/crates/quaint/)

</comment><comment><USER7> I've never understood the appeal of this sort of thing. The idea is create a common interface to a bunch of different databases. But you still have to write or generate SQL that is specific to whatever database you're actually using. Outside of a very narrow range of apps (eg SQL-IDE kinds of tools), you're going to be both coupled to a specific database and limited by lowest- common-denominator design constraints in the interface library. Ugh.

<comment><USER8> Having to fine tune SQL, or change store procedure syntax call, is a tiny change, compared to rewriting from scratch the complete database binding code.

Plus for many kind of applications, the ANSI SQL coverage across RDMS is quite ok.

</comment></comment><comment><USER9> I think the initiative is great. I did lots of Java database development. Starting with JDBC, circumventing J2EE with Spring and Hibernate, and ending up doing JPA with Spring. I haven't seen anything similar in Rust.

Therefore I recommend looking at JPA for object relational mapping, and Spring Frameworks JdbcTemplate for things like basic CRUD support and JPA abstraction.

<comment><USER10> These tools are my daily ones too, but they're abstractions on top of JDBC and as such a different gap than what the author is trying to fill.

</comment></comment><comment><USER11> The work made by this guy is incredible. Apache arrow commiter (Datafusion), wrote SQL crate, BAllista (think spark+k8s-java+rust), and now this.

I feel too much envy.

</comment><comment><USER12> > RDBC is specifically for the use case where a developer needs the ability to > execute arbitrary SQL against any database and then be able to fetch the > results.

So RDBC solves the problem of different connection protocols. But what do you do about the fact that writing a query that works for every database is extremely difficult?

<comment><USER13> You don't do anything about that in this context. The queries you write must target the database you are going to use.

<comment><USER12> Right, I'm just curious what the use case is where you want to be able to abstract over the connection for a variety of relational databases, but don't need to abstract over the differing syntax for the queries.

<comment><USER14> The use case would be the same as the one covered by jdbc and odbc. That is creating a standard interface to connect to databases at a lower level than the orm. This could then be used by an orm or query builder to communicate with the database. That's how for example I can use Spring JPA and if I write either fairly portable sql or use the crud repository methods, I can connect to multiple different sql databases by simply providing a different jdbc URL.

How to handle the differing syntax of each databases would be handled at a higher level, by the query builder or orm. The orm could decide to let the user decide for themselves whether to write portable sql or not and fail at runtime, or like diesel in rust, enforce the useable features through its types.

In my experience that is something that is currently missing in the rust ecosystem. Each library seem to have its own connection logic and if I want to write a program that could run on different databases in rust right now, I have to write different code to connect to each database I would like to support.

Diesel has been serving me really well but I currently need to choose a specific backend when I am building a query, and implementing the above dynamic style of connection would be quite cumbersome to implement. It would be nice if we could choose another a standard sql backend where I would only be able to use a subset of features supported by most sql databases and build queries against that. Hopefully the RDBC project could help with something like that.

</comment></comment></comment></comment><comment><USER15> This is great. Using the traits as the interface is clever. That means as along as a DB specific driver implements the traits, it will work.

<comment><USER16> That's the point, just like JDBC, ODBC, DB-API, ADO.Net, etc.

</comment></comment><comment><USER17> Efficient access is more than the interface on the client. The wire format matters. If the server sends the data in the row form from a columnar stored table in row form, it wont be efficient, there will be too many transformations. Perhaps a way for the client to tell the server what format it wants the data may be useful.

</comment><comment><USER18> Why not use macros to map the result back? I understand that that is not consistent with jdbc and may be crossing into ORM territory, but it does seem like a clean way to handle it in rust.</comment>


Introduce ZSTD compression to ZFS - <AUTHOR> https://github.com/openzfs/zfs/pull/10278 <comment><USER2> See BSDCan 2018 "Implementing ZSTD in OpenZFS on FreeBSD" by Allan Jude:

* [https://www.bsdcan.org/2018/schedule/events/947.en.html](https://www.bsdcan.org/2018/schedule/events/947.en.html)

* [https://twitter.com/allanjude](https://twitter.com/allanjude)

<comment><AUTHOR> This _is_ an iteration of Allan's code

<comment><USER3> It looks pretty mature. Why is this compression not implemented? I checked out the youtube channel of ZFS, but it is nowhere mentioned in the years of monthly sync ups.

</comment></comment></comment><comment><USER4> There's one thing I don't understand. Each time a new compression algorithm is introduced, it's the Next Big Thing. Why isn't the implementation of the algorithm as simple as linking in the related library, assuming they'd all have a similar interface? After all, it seems like what you need is a header and a function that converts a compressed block to a decompressed one and the other way round. Where's the complexity from the API/implementation perspective given that a library is already there?

<comment><USER5> In this case it could use the Linux crypto API, which already has ZSTD support and provides compress/decompress functions. But that is exported as GPLv2 so ZFS needs to do its own thing. And idk if the API is sufficient w.r.t. to e.g. workspace management/reuse.

W.r.t. to ZSTD: The usual thing is to provide a zlib compatible API, which ZSTD does ( [https://github.com/facebook/zstd/tree/dev/zlibWrapper](https://github.com/facebook/zstd/tree/dev/zlibWrapper) ). But the ZSTD zlib compatibility layer causes lower performance, so it is better to use it directly. Maybe all future compression algorithms can provide a ZSTD compatible API, so we have to do less work in the future?

<comment><USER6> Zstd is dual licensed BSD and GPL. It is kind of weird the kernel limits it to GPL modules.

</comment></comment></comment><comment><USER7> lz4 is performing pretty well. Better than most zstd-fast settings. It will not be obsolete after adding ZSTD and most likely stay the go-to algorithm if you are unsure what to choose.

<comment><USER8> FYI lz4 and zstd are made by the same guy, so there is no surprise both of them complement each other. lz4 targets the (de)compress-as-fast-as-possible domain, while zstd is for the rest (good (de)compression with slower speed).

For something that is write-once read-many-times, like a filesystem, a good compression algorithm might be more interesting in the future. lz4 is more targeted at write-once read-once, like file transfers for example

<comment><USER9> Isn't it the opposite? If LZ4 is optimized for decompression speed as you say, then you would want to use it when you read many times, the same file, very fast.

From a quick read, ZSTD looks more about saving space while keeping reasonable speeds, both at write and read.

And I'd assume there are other algorithms that focus only on size, trading speed for it.

<comment><USER8> Depends what "read many times" means.

\- If you mean that the same archive will be distributed to many peers, such as is the case in package distribution, then in practice archives will be read only once by each process, so one "slow" compression will translate into significant gains in added decompression speed. That's the reason Archlinux switched to zstd for its packages ([https://www.archlinux.org/news/now-using- zstandard-instead-o...](https://www.archlinux.org/news/now-using-zstandard- instead-of-xz-for-package-compression/))

\- If you mean that the same archive will be read multiple times by the same machine, I don't really know what kind of scenario that is; I'd deflate the archive into its initial representation once and then let processes access that folder directly. Note that zstd claims that it isn't that much slower in decompression than competitors, even if you always use compressed archives the difference will be minimal

zstd was built more or less to "replace" all formats that favor compression over speed. From their benchmarks (which means what it means) whatever the compression/speed ratio you want, zstd is going to be better than all of them, with a hard exception on extremely fast speed that is still the kingdom of lz4.

<comment><USER10> It also depends on your workload and the speed of your disks.

If your disks are faster than your decompression algorithm when that algorithm is running alongside the rest of your workload (generally not the case) then it can make sense to use the faster decompressor (lz4). In my understanding of the tradeoffs of zstd though, having used it recently in an application, chances are you have a free hardware thread that can saturate your disk without affecting your compute workload.

<comment><USER9> Considering that nowadays many people have an SSD, for boot files that would mean LZ4 is best.

But perhaps for your data files that you don't open often, ZSTD is best because you save space on the SSD.

<comment><USER10> > _Considering that nowadays many people have an SSD, for boot files that > would mean LZ4 is best._

That depends on how concurrent boot is, and how fast your CPU and memory are. It may be true on a Celeron, but maybe not on a ThreadRipper.

Furthermore, if you look at the performance testing, the sequential read performance was almost always better with zstd than with lz4, in ZFS; and the zstd-fast mode was about as fast as the lz4 mode in sequential writes. This may be a matter of their specific integration of lz4, but nonetheless it pays to look at the actual numbers before drawing conclusions.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> An option in the future to write data with a fast zfs level so everything is speedy and recompress blocks which have not changed in some time with a more efficient compression ratio would be really great. So you would have almost no performance penalty writing data and very high compression ratio for old data.

<comment><USER12> Fast compression levels of a given algorithm means lower compression ratio.

I don't know if ZFS supports variable compression levels (maybe per dataset), but Btrfs ZSTD support uses a mount option, e.g. mount -o compress=zstd:[1-15]

Thus it's possible to use a higher level (high compression ratio, slower speed, more CPU and RAM) for e.g. an initial archive. And later use a lower level (or even no compression) when doing updates. Writes use the compression algorithm and level set at mount time; and it's possible to change it while remaining mounted, using -o remount.

<comment><USER13> Btrfs is soon getting support for specifying the level on a per-file basis: [https://github.com/kdave/btrfs- progs/issues/184](https://github.com/kdave/btrfs-progs/issues/184)</comment></comment></comment>


End Police Violence in America - <AUTHOR> http://www.joincampaignzero.org/

<comment><AUTHOR> Some of these policies are insane. [http://www.joincampaignzero.org/contracts](http://www.joincampaignzero.org/contracts)

"prevent investigators from pursuing other cases of misconduct revealed during an investigation"

Who does that protect? That's like arresting someone for stealing a candy bar but not being able to do anything if you found out they stole the whole store.

<comment><USER2> It's so you don't hear stories like "He was unarmed and did nothing wrong but was shot and killed by police." being followed up with "During investigation it was found he had murdered 2 children years ago, held his grandmother hostage, spent 8 years in prison for drug/gang charges, and has warrants for his arrest in 15 states."

I can understand _why_ they would argue for something like this - as it's essentially poisoning the well.

If it was found the person hadn't done any of that previous stuff, would it make them being shot while unarmed "not okay" but because they did all that stuff previously it is suddenly "okay"?

It's distracting from the issue of "this man was shot and killed by police" by trying to justify it with the man's past offenses - even if the past offenses are not relevant to the man being shot.

Note: Unarmed does not mean not dangerous, but that's an argument for another time.

E:

In response to below, I somehow missed that context when looking at it, so apologize for my reply missing the bigger context.

<comment><AUTHOR> This policy is in regard to the police officer. If the officer shoots someone and is investigated, evidence of prior crimes the police officer committed can not be prosecuted.

It certainly doesn't apply to normal citizens. That's why the police sometimes try to catch someone on a minor violation to obtain a search warrant for their home in hopes of uncovering larger crimes.</comment></comment></comment>


Iran Removed From All Major Travel Sites   - <AUTHOR> http://www.airliners.net/aviation-forums/general_aviation/read.main/5825577/

<comment><USER2> "Mr. Gorbachev, open this gate. Mr. Gorbachev, tear down this wall!"

Who's putting up a wall now?

It's funny that when it came to USSR and China, we believed that people-to- people contact would improve relations. Why doesn't the same apply to Cuba and Iran?

<comment><USER3> I'd suggest that in the case of Iran it is a responsibility issue rather than a politics one. While they have just elected a more west-friendly president there are large parts of the country that are dangerous for outsiders. I'd guess the companies in question might prefer to lose a few sales rather than have the "you booked it, didn't you check where you were going first?" / "you should have warned as at booking time, it is all your fault!" argument.

I'm not sure where Cuba fits in with my little theory though.

<comment><USER2> >> there are large parts of the country [Iran] that are dangerous for outsiders.

Are you kidding me? Have you seen the Rick Steve's special on Iran? I'm bringing RS up because anecdotal evidence wouldn't fly much around here. But please open your mind and take a look.

Every account I've read of travel in Iran has been very positive. It is a much safer country to travel in than, say, Saudi Arabia, Egypt, etc.

<comment><USER4> Probably safer than some parts of Oakland and Washington D.C., too.

<comment><USER5> DC is actually fairly safe nowadays (except perhaps for Northeast or Anacostia, but no one is going to end up there by accident).

<comment><USER4> Relative to historical periods, yes, but it's still a war-zone compared to what I'm used to.

The 2010 statistics indicate a homicide rate of 21.9 per 100,000 population. That's as bad as Brazil, worse than Kenya, and slightly worse than The Democratic Republic of Congo. (Source: [http://en.wikipedia.org/wiki/List_of_countries_by_intentiona...](http://en.wikipedia.org/wiki/List_of_countries_by_intentional_homicide_rate), [http://en.wikipedia.org/wiki/Crime_in_Washington,_D.C.](http://en.wikipedia.org/wiki/Crime_in_Washington,_D.C.)).

For perspective, the city I live in has a murder rate of 1.9, only slightly higher than the national average.

<comment><USER6> You can't really compare cities to entire countries unless those countries are city-sized.

For example, while Brazil has a per capita homicide rate of ~23 per 100,000 the state of Alagoas has a homicide rate of 60.3, and the Federal District has one of 34.1.

Source: [http://en.wikipedia.org/wiki/List_of_Brazilian_states_by_mur...](http://en.wikipedia.org/wiki/List_of_Brazilian_states_by_murder_rate)

<comment><USER4> Some of those countries aren't all that big. Dominica is about on par with Washington D.C. and has a population 1/10th the size in an area only a few times bigger.

Sure, parts of Brazil are a war-zone, as are parts of Mexico in the bitter battle over drugs, but that just skews the average up for the rest of the country, meaning Washington D.C. is worse than many parts of Brazil.

To start splitting hairs, I bet there's parts of Washington D.C. that are on par with the worst parts of Brazil.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This travel diary and the Iranian people I've met through Work and University really made me question the mainstream medias depiction of Iran.

[http://c90adventures.co.uk/index.php?option=com_content&view...](http://c90adventures.co.uk/index.php?option=com_content&view=article&id=80:iran&catid=37:category- for-malaysia-trip&Itemid=18)

<comment><USER8> Really? You don't think it's possible for a decent people to be ruled by an abhorrent government?

<comment><USER9> Yes, it's possible - the Obama administration :) Shall we declare the US a no fly zone?

<comment><USER10> Nobody has declared Iran a no fly zone.

Edit: to clarify, 'no fly zone' has a specific meaning that doesn't apply here - [http://en.wikipedia.org/wiki/No-fly_zone](http://en.wikipedia.org/wiki/No- fly_zone)

</comment></comment></comment></comment><comment><USER11> A pity if this is a concerted campaign, as I've mentioned here before visiting Iran is pretty straightforward if you're not from the US/UK and very worthwhile - blog post with some info here: [http://www.sarahandniall.com/2011/08/iran.html](http://www.sarahandniall.com/2011/08/iran.html)

And one by my partner on traveling as a foreign woman in Iran: [http://www.sarahandniall.com/2011/09/traveling-as-woman- in-i...](http://www.sarahandniall.com/2011/09/traveling-as-woman-in-iran.html)

</comment><comment><USER12> Economic sanctions are an act of war. It's the citizens that are hurt the most.

<comment><USER13> The citizens that elected rather unfriendly presidents and governments.

<comment><USER12> The US is proving to be a rather bad actor. Drones. NSA Spying. Indefinite detention.

Should the rest of the world place economic sanctions on the US?

<comment><USER14> This is stereotypical "point spread" moral relativism. The standards with which American citizens hold their government to should of course be quite high, but by no means should we take failure to meet those standards to be in remotely the same league as the sorts of activities the Iranian regime undertakes.

<comment><USER15> How many countries has Iran invaded in the past 20 years? How many civilian dead in foreign countries can be laid at the feet of the Iranian military?

Please recall that the US backed Saddam against Iran once upon a time.

<comment><USER8> The point is not how much _has_ it done, but how much it would have done if it had the power. If Iran and the US had swapped places there would have been far more death and destruction across the world, all in the name of religious supremacy.

I can't say I like what the US is doing with drone strikes and repeated, unwinnable wars, but don't think for a minute that Iran would be a beneficient world hegemon. The world would be an awful place to live.

<comment><USER15> > If Iran and the US had swapped places there would have been far more death > and destruction across the world...religious supremacy.

That's a supposition for which you have no support. The fact is that non- religious States have murdered far more civilians in the past 100 years than any religion has.

That's not a defense of religion. It's a simple statement of historical fact.

<comment><USER8> My statement is a counterfactual, so it's certainly hard to prove. But look at who runs that country, why they run it and what their values are.

> That's not a defense of religion. It's a simple statement of historical > fact.

It's also completely irrelevant.

<comment><USER15> History is relevant. Always.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Surely the sites mentioned (Kayak, Expedia) just use third-party data from airlines and such to provide listings? If so, it's unlikely they are the ones removing Iran from the tables.

<comment><USER17> so why does hipmunk still work?

[edit: i looked at ita. it says that it supplies kayak and google flights. google flights shows flights to tehran (i checked). kayak does not (according to the article). that does not seem to support the idea that ita is filtering data, unless it is doing so at the client's request.]

<comment><USER16> I have no idea. This StackOverflow post gives a good rundown of where the data comes from:

[http://stackoverflow.com/a/4612221/470339](http://stackoverflow.com/a/4612221/470339)

 _" you probably want to connect to somebody a bit more down the food chain, with a better API."_

Obviously I have no idea how anyone does it, but it seems plausible that it is the data providers rather than consumer-facing sites. Look at the ITA site:

[http://www.itasoftware.com/](http://www.itasoftware.com/)

<comment><USER18> I still see full flight data to IKA on my terminal, so it does not appear to be filtered from data providers (plural). I suppose there could be one provider that filtered it and a few sites depend on them.

</comment></comment></comment></comment><comment><USER19> I agree let them be countries are sovereign and if nukes are the problem why not international proliferation ?

Although a simple comparison the jist of it is no different than being in a standoff: 2 people pointing guns at each other and one side demands, "give me your gun".

<comment><USER20> If nukes are the problem, why is Israel not sanctioned to hell and back? Have nukes, refuse to sign NPT.

Because nukes aren't the problem. Protecting US interests by destabilising Iran is the problem.

<comment><USER8> Israel is not in breach of international law with its nuke program _exactly because_ it is a non-signatory to the NPT.

Iran _is_ a signatory and it has obligations under that treaty that it is not fulfilling.

And being vigilant on Iran is not just protecting US interests. It's protecting anyone who believes in freedom and liberal values. If Iran had nuclear weapons then it would be the second most awful world power to have them. It would be much worse in practice than NK having them though, because it actively sponsors terrorism around the world.

<comment><USER19> How do you know they would be the second most awful people to have them ? You are led to believe they are awful and if they have them they will use. What if they are not? What fact do you have?

I have no agenda I am nor pro Iran nor against, because I simply do not have enough facts or knowledge. I hear from the media they are terrible and almost as bad as North Korea... But what if they are not right? Can a US publication come out and say: "Hey Iranian leaders might feel they need nuclear weapons because otherwise they are helpless against an invasion by supreme powers just the Iraq and other nations were". Can a US news outlet make such a claim? Maybe some editorials here and there but the reality is present media is not entirely different than cold war Soviet media. Besides the obvious differences that you and I can both see, differences on agenda setting are not that great when it comes to SPECIFIC issues like Iran.

What would have happened if Iran was left alone? Who knows. What if US policy was to say: fine go make nukes but know the obvious, if you do anything stupid WW3 will be fought over the middleeast (and probably will be the case regardless or somewhere in Asia).

>Iran is a signatory and it has obligations under that treaty that it is not fulfilling.

This point I completely agree with. IF they are a signatory they are obliged...However, does the US adhere to every deal they signed ? Does any nation ? We bend our own constitution when we see fit.

We detain people for infinity without charging them in black prisons.

We fly an army of killer robots over any nation we please as long as they do not have the might or spine to respond and our tied to our foreign aid lifeline - where 1/7 people killed are children and 50% are innocent (according to a recent report also covered 2 days ago here on HN).

So who are we to tell them about obligations and sticking to the rules?

<comment><USER8> > How do you know they would be the second most awful people to have them ? > You are led to believe they are awful and if they have them they will use. > What if they are not? What fact do you have?

These are very worthwhile questions. I've spent a lot of time investigating this subject and have come to certain conclusions. It would be foolish for anyone to believe me just because I've made these assertions on a forum on the internet, so I would encourage anyone interested to do their own research and come to their own conclusions.

</comment></comment></comment></comment></comment><comment><USER21> It's very sad to see innocent people punished because their government has a backbone.

<comment><USER8> Their government are an evil, theocratic, messianic cult who care nothing about their people but do care about promoting barbarism internally and terrorism externally to further their dispicable agenda. There are few more evil governments on the planet right now.

If you want to be sad about the punishment of the innocent Iranian people, be sad that Khomeini's thugs murdered, jailed or otherwise incapacitated all the real liberals during that country's revolution.

<comment><USER22> It's a curious thing, good vs evil. It seems to me that there are few true Luke Skywalker vs Darth Vader scenarios in history. Rather, every political leader has a bit of Darth Vader in them. There's something about that power that brings out the scum in all of us.

<comment><USER8> I never mentioned good. The Iranian government is evil. Most of the governments of the rest of the world are just human, that is, as you say, morally mixed.

</comment></comment></comment></comment><comment><USER23> Three months ago when we were trying to book from California to Tehran it was impossible to find flights. It seems google brought back Tehran to their list now but many others don't have it yet.

Sucks to be innocent victom of a conflict that you didn't do anything for it. I can not even do a anything to change either.

<comment><USER24> Aren't flights from UAE to Iran super frequent and cheap? I'd just fly to DXB or AUH (ideally, Etihad, one of the underrated airlines in the world) and then book the Iran leg independently, maybe even on arrival.

</comment></comment><comment><USER25> [https://www.google.com/flights/#search;f=SFO;t=IKA;d=2013-08...](https://www.google.com/flights/#search;f=SFO;t=IKA;d=2013-08-08;r=2013-08-12)

<comment><USER26> Maybe OPs searches didn't work because of the accent on Tehrān

</comment></comment><comment><USER9> This is a part of an ongoing campaign of the US to take over Iran. Havoc in the Middle East is the ground work for the coming coup/invasion.</comment>


AskHN: How do engineers research a market for a new product? - <AUTHOR>

I have an idea for a new product at my company but I'm kind of clueless about the business end of things. I'm certain there is value in what I have in mind and that it would solve a real problem but I want to know how big the market would be or if it is plausible from a business/market perspective.<p>Thinks like the costs involved and potential savings are a kind of focus for me right now but any real kind of advice would be great. <comment><USER2> My experience with F500 companies is that they are extremely political. This means that lots of ideas get funded without any analysis of the value. The dynamic in each company and potentially each division will be different. Ultimately you might be more successful if you can find a director level or above who can pitch it for you. At the very least you should be able to articulate the value to consumers and the compnay in a few sentences with maybe an additional one or two sentences to describe how it works. Ultimately your desire and passion to make it happen is potentially more important than the idea itself.

What people should care about: 1) target and size of market 2) alignment to current product mix/message 3) cost/risk to produce 4) how will this benefit the company

What they really care about is: 1) what am I bonused on 2) How can I get a promotion 3) How will what you are telling me help me with 1 or 2 4) Will I be embarrassed if I place a bet on you

</comment><comment><USER3> * Consider that your audience will not fully understand your idea unless you can effectively present it - take the time to build a visual presentation * Estimate time/effort to complete the project, the cost of integration into the current IT environment, on going needs (people/ systems / support) * Revenue structure and model - per seat, per month, per licence, one time * off set costs with revenue to show time line of profitability based on a log of sales. be conservative. let other people you can sell more * build a prototype - even a poor one but make it look good. Most business types take visual cues to reflect on code quality. They do not understand Algos. Don't discuss it with people that do not understand the math / concepts. Talk about the solution to a problem instead. * If possible build two documents: one is a powerpoint presentation with the above information. The other is a prose document outlining in deeper information the system/ concept / etc * Give it away - you don't need to own the project. Find the individuals in your firm that can get it done. Get them interested in the project. Let them help you sell it. * Market Research is red ocean. You can only know what has been done and with what demographics. You can not understand blue oceans from market data. Determine if your product / service is new/unique/special/ and if it is red ocean do the work. find the demographic, understand the competition. Figure out the four forces (five) and break down their busienss / profit models. If it is blue ocean, map the shift. Where are you taking the model vs the current solution framework. * Be persistent, as that is the measure of an idea. If you wont fight for it, why would anyone else? The best ideas do not always win. * Break down the presentation with an action list. what to do next. who to do it. time lines. * Make sure you would use it, if you were the customer. Otherwise, why would you build it? (unless you are in finance, then this doesn't really matter does it?) * Patent the idea before you give it to you boss. Just for the hell of it. You can always licence it to the company. :-)

</comment><comment><USER4> Why not ask around your marketing/market research departments?

If you must DIY, here are some suggestions:

* Find the (estimated) number of users of the general product category (I'm sure googling will lead you to authentic sources publishing such data for your segment) and then estimate what percentage of this could be the potential users.

* Make a landing page describing the product in general and collect leads (to drive traffic to this, email your contacts who could be interested, request them to invite others, announce/post it on a few relevant forums/blogs etc.). Track the conversion rate and extrapolate it against the total category user base.

-HTH</comment>


Things you can't do you in Rust: destructure vectors - andrew-lucker https://medium.com/@andrew_subarctic/things-you-cant-do-you-in-rust-destructure-vectors-9e2d2461725a <comment><AUTHOR> This is actually not true. You can't do it in stable rust, but on nightly slice destructuring has been possible for a while now (just as the compile error indicates).

See:

\- [https://doc.rust-lang.org/unstable-book/language- features/sl...](https://doc.rust-lang.org/unstable-book/language- features/slice-patterns.html)

\- [https://doc.rust-lang.org/unstable-book/language- features/ad...](https://doc.rust-lang.org/unstable-book/language- features/advanced-slice-patterns.html)</comment>


Block disposable emails - <AUTHOR> http://www.block-disposable-email.com/

<comment><USER2> What about disposable email address services who offer exclusive domains for paying customers? Are you going to characterize those addresses as "fake"? I see you are actually doing that now!

I know these evil disposable email address users and they are not the abusers you think they are. In fact a lot of them have been more abused by the sites you are providing a service to than vice versa.

There are better ways of combating abusers then just banning a domain, and would cause a lot less grief. A central repository of "fake" domains inevitably will cause false positives on a large scale and will cause a whole lot of grief to everybody.

Full disclosure: I came out with the first disposable email address service, as far as I know, and I'm quite certain I even coined the term "disposable email address", as obvious as it may seem, it wasn't at the time, and I can't imagine what you think of me!

</comment><comment><USER3> I use sneakemail.com as a way of filtering mail and tracking email addresses I give out to web sites and mailing lists (/not/ as 'disposable' addresses), and both their domains (sneakemail.com and the newer snkmail.com) are blocked by this service.

Blocking these email addresses is counterproductive. The only site I've encountered in the past that blocked Sneakemail was Digg, and I didn't sign up as a result. They /may/ have blocked a few 'disposable' accounts with this strategy, but they /definitely/ lost at least one 'real' user because of it. In addition to this, I have no doubt that there were orders of magnitude more 'disposable' Hotmail and GMail addresses signed up for Digg that there would have been Sneakemail addresses, so they need to deal with the 'problem' of undetectable disposable accounts anyway.

Sneakemail is a great service, BTW. I hope stuff like this doesn't render it useless.

<comment><USER4> Yes, quite. Hotmail and gmail etc offer what are essentially disposable addresses (free to sign up). The _only_ issue with these is that there is _some_ overhead with signing up - a fair amount of personal data required, which whilst can be faked they (well hotmail anyway) does annoying things like confirm validity of zipcode.

</comment></comment><comment><USER5> The goal should be attracting customers that want to read your emails. If they are using disposable emails, that means you do something wrong. Maybe you should skip email requirement?

<comment><USER6> I can't agree more. Regardless of whether you force your customers to use a real email address or not isn't going to change the fact that if they don't want your emails they aren't going to read them.

If you force the emails on them they are only likely to become annoyed at your company and reduce their interactions with you.

Do two things. Make the email address optional. Make the email content so desirable that the customers provide their real email address at their own free will. It's the best of both worlds, now you only have email addresses in your list of people who are genuinely interested in seeing your content.

</comment></comment><comment><USER7> Next week on HN, I'll unveil my new browser extension: block-sites-that-block- disposable-emails.com.

Why should I trust someone I've never heard of with my real email address? Trust is earned, and I am not going to use a service that requires a "real" email address.

Besides; I run my own email server... how do you even know I'm delivering your email to a file and not to /dev/null? You don't. This service is bullshit.

</comment><comment><USER8> Any free email provider can be used for fake, one-time, temporary email addresses - it just takes a bit more time to register another one. It's just annoying when email is needed to create an account, and way more annoying when it filters email addresses for no reason.

<comment><USER9> Yes, and this is a war that cannot be won. Measures like this will simply escalate it to the next level. The reason people use throwaway accounts is because they don't want to receive email as a consequence of signing up. The solution seems simple: don't require email to create an account.

</comment></comment><comment><USER10> And if a website enforces this, well, I didn't want to sign up anyway.

</comment><comment><USER11> I can imagine several different PHB deciding to require that the developers use this.

The problem is that if the user doesn't want to read you email, they won't.

This service is like selling megaphones to advertisers - it doesn't make people buy your service/read your email but it does increase the profit for the megaphone suppliers.

</comment><comment><USER12> This is starting to feel like an arms race. Next, there will be undetectable disposable emails, and then automatic detection of undetectable disposable emails.

</comment><comment><USER13> I have a catch-all account for my domain. If I sign up for a service I use their domain as the user on the address I give out. E.g. email@example.com.

The result is that all email that isn't personal nor directly related to my business gets sent to an account that I check once a day.

If an address gets spammy or, like the Epsilon situation, a service provider gets hacked I can block my account without consequence.

</comment><comment><USER14> Here's a thought: instead of dealing with crap like this, what about a service for mailing lists that collects email addresses, and stores them internally. Companies wanting to reach customers can put the signup form as js on their websites, but never get the actual email addresses. The mailing list service passes the newsletters on to subscribers, who are free to click links and form a more direct relationship with the client company, but guarantees to users that:

1\. It will never directly pass email addresses to the client company or any third party.

2\. All unsubscribes will be respected immediately.

So you can sign up with confidence. The downside for the client company is it doesn't get those sweet, juicy email addresses. The upside - lots more signups, and no fake addresses.

<comment><USER15> Feeds (atom, rss) solves this quite well already.

<comment><USER4> really? can you expand on this?

<comment><USER15> Instead of sending out a newsletter, the company just adds an item to its feed.

Interested users can add the feed to their feed-reader, and can unsubscribe at any point by removing it again.

It has all the benefits of the OP's suggestion, but it is already available. I guess it is debatable whether having it in your feed reader or inbox is a pro or a con (I personally don't want mass email in my inbox).

</comment></comment></comment></comment><comment><USER16> One problem with a service like this is: how do I know if I can trust it with people's email addresses? How do I know that this site doesn't store the emails tested and sell them to spammers?

<comment><USER7> _How do I know that this site doesn't store the emails tested and sell them to spammers?_

Why wouldn't it?

</comment></comment><comment><USER17> Hi

Kevin is right, also jrmg and most others from my point of view. I am the one who started the service discussed.

As in every topic there are at least two positions. I think in normal cases the service will help service providers to keep the userdatabase clean of temporary mail addresses. From the point of a user (and I am often only a user looking for services) it should also not be a problem to give a email address away if you trust the provider.

But I agree: In special cases acting as a user it is useful not to give someone the email address. Like a creditcard number.

From providers angle I would decline such email addresses in every case. Most of the services are free today - so the only return service is to have a communication channel to the user. It's clear for me not to spam my users as I treat them as customers.

It's up to you if and how you use the service. And hopefully most of you would like them.

But I know that not everyone is happy with that kind of abuse killing abuse killing systems ... (see jrockways new idea of block-sites-that-block- disposable-emails.com).

Best regards,

Gerold <http://www.block-disposable-email.com>

<comment><USER18> Why is this not done as an RBL-style DNS-based blacklist? The queries are cheaper, mirroring and distributed caching are already built-in...

Of course, charging for access would be harder, but you can still offer to sell people lists who don't want to rely on external infrastructure.

<comment><USER17> I had DNS RBL in mind because of your mentioned advantages. But the service needs the new domain-feed done by users requesting the service. As far as I know this is not possible by DNS RBL.

And: for me it was easier to develop a web based service than doing new things with bind.

Gerold

<comment><USER18> Fair 'nuff. :-)

In case you want to revisit, dynamic DNS is really easy to do with PowerDNS (an alternative to bind).

I've combined PowerDNS and Redis with a relatively thin Python glue layer, and then done some funky things with subclassing that to create programmatic answers to certain queries instead of just looking things up. PowerDNS also has native backends for MySQL and some others.

If you're interested in my Python/Redis stuff, the code is here: <https://github.com/pagekite/PyPdnsRedis/>

</comment></comment></comment></comment><comment><USER19> <http://www.block-disposable-email.com/response_codes.php> says:

 _"MX does not exist": The corresponding domain does not have a mailexchanger (MX-DNS RR). Domains without a MX are not able to receive emails._

No! Lack of an MX does NOT mean non-deliverable!

</comment><comment><USER20> Or you can use the old email@example.com.

<comment><USER21> Don't you know that having a plus sign in your email breaks half of the websites' regex.

        "There is an invalid character in your email address,
        please try again."

<comment><USER22> then it's worth letting them know their site is broken.

</comment></comment></comment><comment> the-kenny In Gmail, you can add arbitrary dots (.) to your email address and add filters based on it: firstname.lastname@example.com You can also append a plus-sign with arbitrary text on it: email@example.com Both will route mails to firstname.lastname@example.com.

As said, you can add a filter to add a label to all mails to this address and skip inbox for them. That's what I do.</comment>


Barbara Hillary, First Black Woman to Reach the Poles, Is Dead at 88 - <AUTHOR> https://www.nytimes.com/2019/11/26/us/barbara-hillary-dead.html <comment><USER2> This was a fascinating read. She was 75 when she visited the north pole, and 79 when she went to the south. And she had to learn how to ski first. Not only that, she was a breast and lung cancer survivor, and only had half her lung capacity.</comment>